Run the ruleset drift check on a schedule #166

scripts/apply-rulesets.ts --check (just rulesets-plan --check) exits 1 when a repo's branch rulesets differ from rulesets/index.ts, but no workflow runs it, so drift is only found when someone runs the plan by hand.

Proposal

• A scheduled workflow (weekly, plus workflow_dispatch) that runs bun scripts/apply-rulesets.ts --check and writes the plan to the job summary.
• Auth: the script uses gh, which needs to read rulesets on every managed repo. Use a GitHub App installation token (actions/create-github-app-token) scoped to administration: read on the managed repos, not a PAT. Check whether the existing release-bot App can carry that permission or whether a separate read-only App is cleaner.
• Read-only: never --apply or --prune from CI.
• Also run it on PRs that touch rulesets/**, so a config change shows its plan before merge.

Done when

• A hand edit to a managed repo's ruleset turns the scheduled run red within a week, with the diff in the summary.